1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Lagging Machine

Discussion in 'Malware and Virus Removal Archive' started by Dcmurray, 2010/03/15.

  1. 2010/03/15
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    [Inactive] Lagging Machine

    Hello, I'm not sure but I think I may have picked up something. my machine really starts to lagg when playing video. Could you please have a look?



    DDS (Ver_09-12-01.01) - NTFSx86
    Run by Owner at 11:48:40.54 on Mon 03/15/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.209 [GMT -3:00]

    AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\WINDOWS\system32\crypserv.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Winsim\ConnectionManager\SimplyConnectionManager.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Winsim\ConnectionManager\Simply.SystemTrayIcon.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Owner\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.cbc.ca/ns/
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10d.exe
    mRun: [ConnectionManager] c:\program files\winsim\connectionmanager\Simply.SystemTrayIcon.exe
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1072873752953
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219257687734
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    Handler: intu-qt2008 - {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - c:\program files\quicktax 2008\ic2008pp.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    Hosts: 127.0.0.1 www.spywareinfo.com

    ============= SERVICES / DRIVERS ===============

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-11-16 108792]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-11-16 96408]
    R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-11-16 735960]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-2-10 54752]
    R2 Simply Accounting Database Connection Manager;Simply Accounting Database Connection Manager;c:\program files\winsim\connectionmanager\SimplyConnectionManager.exe [2009-8-21 16680]
    S2 gupdate1ca24fdf82ceca0;Google Update Service (gupdate1ca24fdf82ceca0);c:\program files\google\update\GoogleUpdate.exe [2009-8-24 133104]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]

    =============== Created Last 30 ================

    2010-03-07 13:25:18 0 d-----w- c:\program files\IMSIDesign
    2010-03-07 13:25:18 0 d-----w- c:\docume~1\alluse~1\applic~1\IMSIDesign
    2010-03-06 23:55:17 0 d-----w- c:\docume~1\owner\applic~1\Chief Architect X2 Trial Version
    2010-03-06 23:54:19 0 d-----w- c:\docume~1\alluse~1\applic~1\Chief Architect X2 Trial Version
    2010-03-06 20:57:19 0 d-----w- c:\docume~1\owner\applic~1\GetRightToGo
    2010-02-26 14:12:53 0 d-----w- c:\program files\MSECache
    2010-02-24 23:36:31 0 d-----w- c:\windows\system32\wbem\Repository
    2010-02-24 23:36:13 0 d-----w- c:\windows\USBdevice
    2010-02-24 23:36:13 0 d-----w- c:\program files\D-Link
    2010-02-24 16:46:44 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
    2010-02-24 16:46:06 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
    2010-02-24 16:38:32 0 d-----w- C:\found.000
    2010-02-24 15:42:03 0 d-----w- c:\program files\D-Link(2)
    2010-02-22 17:48:51 0 d-----w- c:\program files\Shape Collage
    2010-02-21 22:44:11 0 d-----w- c:\program files\ESET
    2010-02-21 15:38:00 0 d-----w- c:\windows\system32\appmgmt
    2010-02-21 14:04:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
    2010-02-20 22:15:37 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
    2010-02-20 22:12:28 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
    2010-02-20 15:46:54 7680 --sha-w- c:\windows\Thumbs.db
    2010-02-20 03:06:33 178176 ----a-w- c:\windows\system32\unrar.dll
    2010-02-20 01:19:58 0 d-----w- c:\program files\Wildfire
    2010-02-18 22:02:27 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
    2010-02-18 22:02:27 47360 ----a-w- c:\docume~1\owner\applic~1\pcouffin.sys
    2010-02-18 22:01:59 0 d-----w- c:\program files\DVDFab 6
    2010-02-16 16:02:17 0 d-----w- c:\docume~1\alluse~1\applic~1\Magix Shared
    2010-02-16 15:53:47 0 d-----w- c:\docume~1\owner\applic~1\MAGIX
    2010-02-16 15:47:47 0 d-----w- c:\docume~1\alluse~1\applic~1\MAGIX
    2010-02-16 15:47:39 0 d-----w- c:\program files\common files\MAGIX Services
    2010-02-14 12:27:09 116672 ----a-w- c:\docume~1\owner\applic~1\GDIPFONTCACHEV1.DAT

    ==================== Find3M ====================

    2010-02-24 16:34:24 647996 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2010-02-24 16:34:24 1333280 --sha-w- c:\windows\system32\drivers\fidbox2.dat
    2010-02-24 16:34:24 126044 --sha-w- c:\windows\system32\drivers\fidbox2.idx
    2010-02-24 16:34:23 48303392 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2009-12-21 19:14:05 916480 ------w- c:\windows\system32\wininet.dll
    2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe
    2004-10-01 18:00:16 40960 ----a-w- c:\program files\Uninstall_CDS.exe
    2009-10-08 19:03:27 16384 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
    2009-10-08 19:03:27 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

    ============= FINISH: 11:49:50.67 ===============
     
    Dcmurray,
    #1
  2. 2010/03/15
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-12-01.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/31/2003 8:09:38 AM
    System Uptime: 3/15/2010 7:35:01 AM (4 hours ago)

    Motherboard: Intel Corporation | | D945GPM
    Processor: Intel(R) Celeron(R) CPU 3.06GHz | J3E1 | 3066/133mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 466 GiB total, 378.669 GiB free.
    D: is CDROM ()
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable
    J: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Intel(R) PRO/1000 PL Network Connection
    Device ID: PCI\VEN_8086&DEV_109A&SUBSYS_309C8086&REV_00\4&6C79FC5&0&00E0
    Manufacturer: Intel
    Name: Intel(R) PRO/1000 PL Network Connection
    PNP Device ID: PCI\VEN_8086&DEV_109A&SUBSYS_309C8086&REV_00\4&6C79FC5&0&00E0
    Service: e1express

    Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
    Description: WALKMAN NWZ-S616F
    Device ID: USB\VID_054C&PID_0327\BEB945434632
    Manufacturer: Sony Corporation
    Name: WALKMAN NWZ-S616F
    PNP Device ID: USB\VID_054C&PID_0327\BEB945434632
    Service: WUDFRd

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description:
    Device ID: ACPI\AWY0001\4&3036D68D&0
    Manufacturer:
    Name:
    PNP Device ID: ACPI\AWY0001\4&3036D68D&0
    Service:

    ==== System Restore Points ===================

    RP141: 12/16/2009 11:01:45 AM - System Checkpoint
    RP142: 12/17/2009 11:46:16 AM - System Checkpoint
    RP143: 12/18/2009 11:48:45 AM - System Checkpoint
    RP144: 12/19/2009 12:01:33 PM - System Checkpoint
    RP145: 12/21/2009 8:31:37 AM - System Checkpoint
    RP146: 12/23/2009 9:42:49 AM - System Checkpoint
    RP147: 12/24/2009 1:42:11 PM - System Checkpoint
    RP148: 12/25/2009 4:43:03 PM - System Checkpoint
    RP149: 12/27/2009 1:59:44 PM - System Checkpoint
    RP150: 12/28/2009 4:24:49 PM - System Checkpoint
    RP151: 12/29/2009 4:33:11 PM - System Checkpoint
    RP152: 12/30/2009 4:45:33 PM - System Checkpoint
    RP153: 12/31/2009 5:07:31 PM - Installed D-Link RangeBooster N DWA-142
    RP154: 1/2/2010 8:44:27 PM - System Checkpoint
    RP155: 1/3/2010 9:09:21 PM - System Checkpoint
    RP156: 1/5/2010 9:00:44 AM - System Checkpoint
    RP157: 1/6/2010 9:19:56 AM - System Checkpoint
    RP158: 1/7/2010 9:21:47 AM - System Checkpoint
    RP159: 1/8/2010 9:50:29 AM - System Checkpoint
    RP160: 1/9/2010 2:02:24 PM - System Checkpoint
    RP161: 1/10/2010 2:12:30 PM - System Checkpoint
    RP162: 1/11/2010 2:54:04 PM - System Checkpoint
    RP163: 1/12/2010 3:19:41 PM - System Checkpoint
    RP164: 1/13/2010 9:40:20 AM - Configured Simply Accounting by Sage 2009 Product Update
    RP165: 1/13/2010 9:49:33 AM - Configured Simply Accounting by Sage 2009 Product Update
    RP166: 1/13/2010 10:09:07 AM - Configured Simply Accounting by Sage 2009 Product Update
    RP167: 1/13/2010 10:13:35 AM - Software Distribution Service 3.0
    RP168: 1/13/2010 10:25:35 AM - Configured Simply Accounting by Sage 2009 Product Update
    RP169: 1/14/2010 8:07:13 AM - Installed Windows Live Upload Tool
    RP170: 1/15/2010 1:31:36 PM - System Checkpoint
    RP171: 1/16/2010 1:40:11 PM - System Checkpoint
    RP172: 2/16/2010 2:41:14 PM - System Checkpoint
    RP173: 2/17/2010 3:04:01 PM - System Checkpoint
    RP174: 2/18/2010 3:25:41 PM - System Checkpoint
    RP175: 2/19/2010 3:27:07 PM - System Checkpoint
    RP176: 2/19/2010 9:19:55 PM - Installed Wildfire
    RP177: 2/19/2010 11:05:59 PM - Installed K-Lite Codec Pack
    RP178: 2/21/2010 9:07:53 AM - System Checkpoint
    RP179: 2/22/2010 9:45:27 AM - System Checkpoint
    RP180: 2/23/2010 9:54:25 AM - System Checkpoint
    RP181: 2/24/2010 10:23:43 AM - System Checkpoint
    RP182: 2/24/2010 12:26:38 PM - Software Distribution Service 3.0
    RP183: 2/24/2010 12:46:06 PM - Installed AVG 9.0
    RP184: 1/24/2010 2:54:28 PM - System Checkpoint
    RP185: 1/25/2010 3:22:20 PM - System Checkpoint
    RP186: 1/26/2010 3:57:34 PM - System Checkpoint
    RP187: 1/28/2010 8:05:54 AM - System Checkpoint
    RP188: 1/29/2010 9:17:45 AM - System Checkpoint
    RP189: 1/30/2010 12:48:16 PM - System Checkpoint
    RP190: 2/1/2010 8:51:30 AM - System Checkpoint
    RP191: 2/1/2010 5:54:52 PM - Avg8 Update
    RP192: 2/2/2010 6:40:16 PM - System Checkpoint
    RP193: 2/3/2010 6:48:32 PM - System Checkpoint
    RP194: 2/4/2010 6:11:21 PM - Installed Microsoft Office XP Professional with FrontPage
    RP195: 2/5/2010 8:02:34 AM - Software Distribution Service 3.0
    RP196: 2/6/2010 11:00:27 AM - Software Distribution Service 3.0
    RP197: 2/8/2010 9:21:22 AM - System Checkpoint
    RP198: 2/9/2010 9:57:46 AM - System Checkpoint
    RP199: 2/9/2010 3:37:24 PM - Avg8 Update
    RP200: 2/9/2010 3:50:24 PM - Configured Microsoft Office Standard 2007 Trial
    RP201: 2/9/2010 4:21:18 PM - Removed Microsoft Office Standard 2007 Trial
    RP202: 2/9/2010 4:27:48 PM - Removed Microsoft Office Publisher 2007 Trial
    RP203: 2/10/2010 8:27:23 AM - Software Distribution Service 3.0
    RP204: 2/11/2010 8:21:04 AM - Software Distribution Service 3.0
    RP205: 2/12/2010 9:21:43 PM - System Checkpoint
    RP206: 2/13/2010 10:49:06 PM - System Checkpoint
    RP207: 2/15/2010 10:08:33 AM - System Checkpoint
    RP208: 2/16/2010 1:22:54 PM - System Checkpoint
    RP209: 2/17/2010 11:29:52 AM - Avg8 Update
    RP210: 2/17/2010 4:05:35 PM - Software Distribution Service 3.0
    RP211: 2/18/2010 4:57:15 PM - System Checkpoint
    RP212: 2/20/2010 1:19:11 AM - System Checkpoint
    RP213: 2/21/2010 9:00:48 AM - Removed AVG 9.0
    RP214: 2/21/2010 9:20:25 AM - Removed AVG 9.0
    RP215: 2/21/2010 9:22:53 AM - Installed AVG 9.0
    RP216: 2/21/2010 10:11:38 AM - Installed Kaspersky Internet Security 2010.
    RP217: 2/21/2010 11:37:56 AM - Removed Firebird SQL Server - MAGIX Edition
    RP218: 2/21/2010 11:41:25 AM - Removed MAGIX Speed 2 (MSI)
    RP219: 2/21/2010 11:42:09 AM - Removed Wildfire
    RP220: 2/21/2010 11:55:51 AM - Installed Kaspersky Internet Security 2010.
    RP221: 2/21/2010 2:38:38 PM - Installed Kaspersky Internet Security 2010.
    RP222: 2/21/2010 3:08:00 PM - Installed Kaspersky Internet Security 2010.
    RP223: 2/21/2010 6:28:01 PM - Installed Kaspersky Internet Security 2010.
    RP224: 2/21/2010 6:44:09 PM - Installed ESET NOD32 Antivirus
    RP225: 2/22/2010 8:32:28 PM - System Checkpoint
    RP226: 2/23/2010 9:51:13 PM - System Checkpoint
    RP227: 2/24/2010 9:23:43 AM - Removed D-Link RangeBooster N DWA-142
    RP228: 2/24/2010 9:40:50 AM - Restore Operation
    RP229: 2/24/2010 11:36:48 AM - Restore Operation
    RP230: 2/24/2010 11:42:02 AM - Installed D-Link RangeBooster N DWA-142
    RP231: 2/24/2010 7:35:27 PM - Restore Operation
    RP232: 2/25/2010 8:05:06 PM - System Checkpoint
    RP233: 2/26/2010 8:31:50 AM - Software Distribution Service 3.0
    RP234: 2/26/2010 10:13:02 AM - Installed Compatibility Pack for the 2007 Office system
    RP235: 2/27/2010 1:15:07 PM - System Checkpoint
    RP236: 3/1/2010 8:59:27 AM - System Checkpoint
    RP237: 3/2/2010 1:41:27 PM - System Checkpoint
    RP238: 3/3/2010 2:04:29 PM - System Checkpoint
    RP239: 3/5/2010 6:58:29 PM - System Checkpoint
    RP240: 3/6/2010 7:06:04 PM - System Checkpoint
    RP241: 3/6/2010 7:54:09 PM - Installed Chief Architect X2 Trial Version
    RP242: 3/6/2010 9:31:42 PM - Removed Chief Architect X2 Trial Version
    RP243: 3/7/2010 9:22:52 AM - Installed TURBOFloorPlan3D Home & Landscape PRO
    RP244: 3/8/2010 9:25:06 AM - System Checkpoint
    RP245: 3/9/2010 10:14:37 AM - System Checkpoint
    RP246: 3/10/2010 10:28:34 AM - System Checkpoint
    RP247: 3/10/2010 3:22:25 PM - Software Distribution Service 3.0
    RP248: 3/11/2010 3:51:36 PM - System Checkpoint
    RP249: 3/12/2010 8:54:24 PM - System Checkpoint
    RP250: 3/13/2010 11:10:07 PM - System Checkpoint
    RP251: 3/15/2010 10:21:15 AM - System Checkpoint

    ==== Installed Programs ======================

    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.3.1
    Adobe Shockwave Player 11.5
    AiO_Scan_CDA (WHat is this?)
    AiOSoftwareNPI (What is this?)
    ArcSoft PhotoImpression
    Avery Wizard 3.1
    Bejeweled 2 Deluxe 1.1.3.2523
    Brain Games Mahjongg
    BufferChm (What is this?)
    C3100
    c3100_Help
    CCleaner (remove only)
    CleanUp!
    Compatibility Pack for the 2007 Office system
    D-Link RangeBooster N DWA-142
    Destinations
    DeviceManagementQFolder
    DocProc
    DocProcQFolder
    DVD Solution
    DVDFab 6.2.1.8 (31/12/2009)
    eGames Collector's Edition
    ESET NOD32 Antivirus
    eSupportQFolder
    Fax_CDA
    Google Earth
    Google Update Helper
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    HP Imaging Device Functions 7.0
    HP Photosmart and Deskjet 7.0.A
    HP Photosmart Essential
    HP Product Assistant
    HP Software Update
    HP Solution Center 7.0
    HPPhotoSmartExpress
    HPProductAssistant
    InstantShareDevicesMFC
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Network Connections 14.2.100.0
    Intel® Matrix Storage Manager
    Java(TM) 6 Update 15
    Junk Mail filter update
    LG MC USB U330 driver
    LG PC Suite II
    LimeWire 5.4.6
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office Live Add-in 1.3
    Microsoft Office XP Professional with FrontPage
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    MSN
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    Multimedia Launcher
    MySQL Connector/ODBC 3.51
    Nero OEM
    NewCopy_CDA
    OCR Software by I.R.I.S 7.0
    PanoStandAlone
    PowerDVD
    PowerProducer
    Prism Video Converter
    ProductContextNPI
    QuickTax 2008
    Readme
    RPS CRT
    Samsung USB Driver (MCCI 4.34) WHQL v3.4
    Scan
    ScannerCopy
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978706)
    Segoe UI
    Shape Collage
    Simply Accounting by Sage 2009
    SolutionCenter
    Spybot - Search & Destroy
    Status
    Switch Sound File Converter
    Text-To-Speech-Runtime
    Toolbox
    TrayApp
    TURBOFloorPlan3D Home & Landscape PRO
    Unload
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB972636)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    WebFldrs XP
    WebReg
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Player 11
    Zulu DJ Software

    ==== Event Viewer Messages From Past Week ========

    3/8/2010 9:50:58 PM, error: Service Control Manager [7000] - The Security Services Driver (x86) service failed to start due to the following error: The system cannot find the file specified.
    3/11/2010 8:00:25 AM, error: Service Control Manager [7000] - The Audio Service service failed to start due to the following error: The system cannot find the path specified.
    3/10/2010 8:37:37 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Audio Service service to connect.
    3/10/2010 8:37:37 PM, error: Service Control Manager [7000] - The Audio Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

    ==== End Of File ===========================
     
    Dcmurray,
    #2


  3. to hide this advert.

  4. 2010/03/15
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc…) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

    References for the risk of these programs are here, and here.

    I would strongly recommend that you uninstall them, and read the links above for educational value!

    Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

    A Malware expert will have a look at your log in due course.
     
    Admin.,
    #3
  5. 2010/03/15
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***


    STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform Quick Scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 3. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Installer under Version 2.0.2
    [DO NOT download version 2.0.3 (beta)]
    Install, and run it.
    Post HijackThis log.
    NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #4
  6. 2010/03/16
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    Hijackthis log as requested

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:17:22 PM, on 3/16/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\crypserv.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Winsim\ConnectionManager\SimplyConnectionManager.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Winsim\ConnectionManager\Simply.SystemTrayIcon.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cbc.ca/ns/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [ConnectionManager] C:\Program Files\Winsim\ConnectionManager\Simply.SystemTrayIcon.exe
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1072873752953
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219257687734
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
    O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
    O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: Google Update Service (gupdate1ca24fdf82ceca0) (gupdate1ca24fdf82ceca0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Simply Accounting Database Connection Manager - Sage Software - C:\Program Files\Winsim\ConnectionManager\SimplyConnectionManager.exe
    O23 - Service: Audio Service (STacSV) - Unknown owner - c:\windows\softwaredistribution\download\install\STacSV.exe (file missing)

    --
    End of file - 6252 bytes
     
    Dcmurray,
    #5
  7. 2010/03/16
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    GMER scan as requested


    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-03-16 11:41:57
    Windows 5.1.2600 Service Pack 3
    Running: jbbviuh6.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\fgecrfog.sys


    ---- System - GMER 1.0.15 ----

    SSDT FFBB9A70 ZwAssignProcessToJobObject
    SSDT FFBBA5F0 ZwDebugActiveProcess
    SSDT FFBBA020 ZwDuplicateObject
    SSDT FFBB91B0 ZwOpenProcess
    SSDT FFBB94B0 ZwOpenThread
    SSDT FFBB9EB0 ZwProtectVirtualMemory
    SSDT FFBB9D50 ZwSetContextThread
    SSDT FFBB9BD0 ZwSetInformationThread
    SSDT FFBB6A90 ZwSetSecurityObject
    SSDT FFBB9910 ZwSuspendProcess
    SSDT FFBB97B0 ZwSuspendThread
    SSDT FFBB9340 ZwTerminateProcess
    SSDT FFBB9640 ZwTerminateThread
    SSDT FFBBA440 ZwWriteVirtualMemory

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2156E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1372] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1936] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2156E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD189 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E2548CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED9C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4717 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[3432] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
    AttachedDevice \FileSystem\Ntfs \Ntfs OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
    AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
    AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)
    AttachedDevice \FileSystem\Fastfat \Fat OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)

    ---- EOF - GMER 1.0.15 ----
     
    Dcmurray,
    #6
  8. 2010/03/16
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    Malware Bytes Scan as requested


    Malwarebytes' Anti-Malware 1.44
    Database version: 3871
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    3/15/2010 6:52:14 PM
    mbam-log-2010-03-15 (18-52-14).txt

    Scan type: Quick Scan
    Objects scanned: 153512
    Time elapsed: 11 minute(s), 47 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    Dcmurray,
    #7
  9. 2010/03/16
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    Thank you so far for your help!

    Dana Murray
     
    Dcmurray,
    #8
  10. 2010/03/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    All looks clean to.
    I suggest, you repost at Windows forum.
     
    broni,
    #9
  11. 2010/03/16
    Dcmurray

    Dcmurray Well-Known Member Thread Starter

    Joined:
    2006/11/09
    Messages:
    322
    Likes Received:
    0
    Appreciate you having a look for me. Thank you I'll repost!
     
    Dcmurray,
    #10
  12. 2010/03/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're welcome :)
     
    broni,
    #11

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...